Will they be penalized? Was Equifax ever penalized?
The cost to them so far is some bad PR which will probably blow over. Especially for companies like Marriott and Equifax which have near monopolies (Marriott owns several smaller chains like Starwood and Ritz Carlton), this probably won't affect their customer loyalty. Particularly when it's safe to assume that the other chains are probably not doing a better job.
Marriott currently has no incentive to spend money to do a good security audit.
They had incentive to do their recent migration of loyalty programs, since Starwood's program was notably generous.
The cost to them so far is some bad PR which will probably blow over. Especially for companies like Marriott and Equifax which have near monopolies (Marriott owns several smaller chains like Starwood and Ritz Carlton), this probably won't affect their customer loyalty. Particularly when it's safe to assume that the other chains are probably not doing a better job.
Marriott currently has no incentive to spend money to do a good security audit.
They had incentive to do their recent migration of loyalty programs, since Starwood's program was notably generous.